~ / search / GHSA-7fv8-6pp7-6h85

GHSA-7fv8-6pp7-6h85

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-45701

Packages

EcosystemPackageAffectedFixed in
Packagist sulu/sulu >= 3.0.0-alpha1, < 3.0.6 3.0.6
Packagist sulu/sulu < 2.6.23 2.6.23

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The password reset tokenand API key generation uses a weak cryptographical hash algorithm. ### Patches Fixed in 2.6.23 and 3.0.6 version. ### Workarounds Patch the related `User.php` and `ResettingController.php` file in the SecurityBundle.

References

External links from the advisory. They lead to third-party sites.